1. Redistributions of documents, or parts of documents, must retain the SWGIT cover page containing the disclaimer.

Transcription

1 Disclaimer: As a condition to the use of this document and the information contained herein, the SWGIT requests notification by before or contemporaneously to the introduction of this document, or any portion thereof, as a marked exhibit offered for or moved into evidence in any judicial, administrative, legislative, or adjudicatory hearing or other proceeding (including discovery proceedings) in the United States or any foreign country. Such notification shall include: 1) the formal name of the proceeding, including docket number or similar identifier; 2) the name and location of the body conducting the hearing or proceeding; 3) the name, mailing address (if available) and contact information of the party offering or moving the document into evidence. Subsequent to the use of this document in a formal proceeding, it is requested that SWGIT be notified as to its use and the outcome of the proceeding. Notifications should be sent to Chair@swgit.org Redistribution Policy: SWGIT grants permission for redistribution and use of all publicly posted documents created by SWGIT, provided that the following conditions are met: 1. Redistributions of documents, or parts of documents, must retain the SWGIT cover page containing the disclaimer. 2. Neither the name of SWGIT, nor the names of its contributors, may be used to endorse or promote products derived from its documents. Any reference or quote from a SWGIT document must include the version number (or create date) of the document and mention if the document is in a draft status.

2 Section 7 Best Practices for Forensic Video Analysis **Previously released as Recommendations and Guidelines for the Use of Forensic Video Processing in the Criminal Justice System and Definitions, Recommendations and Guidelines for the Use of Forensic Video Processing in the Criminal Justice System ** OBJECTIVE The objective of this document is to provide guidance regarding appropriate practices for performing a variety of processing and analytical tasks involving video submitted for examination. SWGIT POSITION ON FORENSIC VIDEO ANALYSIS Forensic Video Analysis (FVA) is a forensic science. In 2002, the International Association for Identification (IAI) formally recognized Forensic Video as a valid subspecialty within the scientific discipline of Forensic Imaging (IAI Resolution ). INTRODUCTION Forensic Video Analysis is the scientific examination, comparison, and/or evaluation of video in legal matters. With an increased prevalence and awareness of Closed Circuit Television (CCTV) surveillance, there are additional investigative opportunities. For example, in 1970, when Sterling Hall at the University of Wisconsin was bombed, there were no CCTV recordings in the area. Twenty-five years later, in 1995, investigators reviewed hundreds of video recordings related to the Oklahoma City bombing. Just six years later, in 2001, thousands of video recordings were examined by federal, state, and local agencies in relation to the terrorist attacks of 9/11. In 2005, the Metropolitan Police Service in the United Kingdom (New Scotland Yard) seized over 55,000 videotapes, hard drives, compact disks, digital video recorders, and other media in support of the investigation of the July bombings in London. FORENSIC VIDEO ANALYSIS GENERAL TASKS The process of FVA can involve several different tasks, regardless of the type of video analysis performed. These tasks fall into three categories: Technical Preparation, Examination, and Interpretation. The general principles and procedures used in these tasks are the same regardless of the format or media in which the images are recorded. This includes both analog and digital media. Technical preparation is the performance of tasks in advance of examination, interpretation, or output. There are a multitude of technical decisions within the various tasks. Technical preparation will affect further stages of FVA. Tasks may include the following; instrument calibration, visual inspections, media characterization, write protection, organization of files, and playback optimization. SWGIT Guidelines for the Forensic Imaging Practitioner 1

3 Examination is the application of image science expertise to extract information from video. Examples may include the following; demultiplexing, decoding digital video and/or images, duplication, capture, reconstruction, format conversion, timeline sequence reconstruction, and standards conversion. Image and video enhancement, frame averaging, video stabilization, and other video processing activities intended to improve the visual appearance of features in a video are also examination tasks. Interpretation in Video Analysis is the application of specific subject matter expertise to draw conclusions about video recordings or the content of those recordings. An example of the former is video authentication. The latter may include determining that an article of clothing appears different in a video than it does under normal lighting conditions due to the properties of the recording process (e.g. an Infrared (IR) negative image effect on natural fibers). Content-based interpretations may also include comparison analysis of such things as clothing or vehicles. If such a content-based interpretation leads to an identification, then it falls within the discipline of Image Analysis. For further information on Image Analysis, refer to SWGIT document Best Practices for Forensic Image Analysis. Note: Technical Preparation, Examination, and Interpretation are tasks, not job descriptions or roles. An individual may perform part of one task or a combination of multiple tasks within the organizational structure of any given activity. Each of these tasks requires its own training and qualifications. Proper methods and practices are necessary in order to get the most out of video evidence. BEST PRACTICES The following are guidelines that describe the SWGIT recommended best practices for forensic video analysis. Evidence Management Agencies should have documented procedures for the handling, transportation, and storage of evidence. Agencies should have chain of custody procedures in place and should follow these procedures. Quality Control and Quality Assurance Quality control and quality assurance policies and procedures should be implemented and documented. Technical and administrative peer reviews are integral components of quality control. Security There should be procedures in place to maintain the security of the working data, all notes, and other such analysis related materials to provide the level of security and privacy needed by the organization. For example, archived case related materials should be stored in a manner that limits access. The degree of access will be agency specific. Infrastructure Agencies should have sufficient space, equipment and facilities to adequately support the required quality and volume of work. 2 Best Practices for Forensic Video Analysis

4 Work Management Forensic Video Analysis is a labor intensive process. An upper limit on caseload should be established for every category of tasks. Documentation Agencies should establish standards for information included in, and the format for, reporting results. Training, Competency, and Proficiency Forensic Video Analysts and/or examiners are encouraged to review SWGIT Guidelines and Recommendations for Training in Imaging Technologies in the Criminal Justice System, SWGIT/SWGDE Guidelines and Recommendations for Training in Digital and Multimedia Evidence and SWGIT/SWGDE Proficiency Test Program Guidelines. Analysts should have certification in their knowledge domain and associated forensic discipline, when such certification is appropriate and available. Note however, that the existence of an external professional certification program does not imply that it is necessary, sufficient, or appropriate. Analysts should demonstrate competency in their discipline prior to being assigned unsupervised case work responsibilities. Analysts should remain proficient through continuing education, training, and peer review of examinations. Agencies should document competency, proficiency and continuing education for each analyst. The analyst should demonstrate: An understanding of the scope of work and how it will be applied in the forensic environment; subject matter knowledge and competence; working knowledge of image and/or video processing and evaluation techniques; working knowledge of applications and tools utilized in the specific agency; working knowledge of SWGIT guidelines for capturing, storing, and processing image/video, including issues relating to topics such as data integrity and compression artifacts; understanding of legal precedent for the use of specific image and/or video processing techniques; knowledge of appropriate case work documentation. Standard Operation Procedures (SOPs) There should be Standard Operating Procedures (SOPs) in place for the tasks being performed. These SOPs should be agency specific, reflect the work flow, and be general enough to permit flexibility for the required tasks. SWGIT Guidelines for the Forensic Imaging Practitioner 3

5 FORENSIC VIDEO ANALYSIS WORK FLOW The following describes a generalized sequence of actions involved in the analysis of video evidence and recommendations for their performance. This is not a training manual, nor a step-by-step methodology. These recommendations represent specific considerations to be addressed by the examiner. The exact sequence will be dependent upon the evidence submitted and the required examinations. Chain of Custody Throughout the entire FVA process chain of custody must be maintained as per agency policy. Submission Review A submission form should be completed for every case the examiner receives, regardless of what type of examination or service the requestor is seeking. See Appendix A for an example. Ensure examiner safety is maintained by determining whether biohazards such as blood or body fluids are present or other special handling is required. Ensure that no other prior examination is required such as latent print or trace evidence. At all times precautions should be taken to ensure video evidence is protected from external factors that may cause damage to the media or to the recorded signal contained on the media. (e.g. magnetic fields, static electric charges, electrical hazards) Physical Inspection Document the physical condition of the evidence. Physical inspection may include the following determinations: Physical damage to media or housing Contaminants (dirt, grease) Media characteristics (manufacturer, size, format) Device settings (hard drive jumper settings, device switch positions) Write protect status Existing labels or identifiers If the media is an obvious copy, such as marked on the label as a duplicate, contact the requestor to determine if the original is available. Any deficiency should be documented and resolved if possible before beginning any forensic analysis (e.g. splicing a broken or damaged tape, restoration into a new cassette housing). 4 Best Practices for Forensic Video Analysis

6 Evidence Marking Evidence needs to be marked per agency policy. Markings could include labeling with initials, ID number, case number or any other identifying information. The ideal method for marking CDs and DVDs is with a non-solvent based felt-tip permanent marker designed to mark optical media. Notations should be made in the clear inner ring as no data information is recorded in that area. Any identifying information (such as serial numbers) should be documented. Inappropriate marking or labeling methods may affect playback and could potentially damage the evidence. Never use a ballpoint pen, pencil or other sharp writing instrument when marking CDs and DVDs Do not use markers that contain solvents Do not use adhesive labels Write Protection Video recording media must be treated in such a manner as to be write protected in order to prevent modification of the media content. For tape based media, record tabs should be removed, or moved to the write-protect position. When possible, playback and file access from optical media should be performed with units incapable of record operations (e.g. CD ROM and DVD ROM drives). This may not be possible for media that has not been finalized. A write blocking method, whether hardware or software, should be utilized for any media whenever possible. For other forms of media storage, the manufacturer's recommendations regarding write protection should be followed. Virus Scan Virus scanning should be performed on any submitted media containing file based digital video recordings. Virus scanning is necessary to both ensure the integrity of the evidential video data, and to protect against malfunction and/or corruption to video processing hardware and/or software systems. The specific methods and software applications used for virus scanning, and remedial actions if a virus is found, will be determined by individual agencies and will be documented within an agency's SOPs. Equipment Selection and Playback Optimization Playback optimization and equipment selection is the process of determining the most suitable equipment and settings for analyzing the output video signal. This includes time base correctors (TBC), playback devices (including field-based VCRs), monitors, capture cards, multiplexers, vectorscopes, waveform monitors, and write blockers. SWGIT Guidelines for the Forensic Imaging Practitioner 5

7 6 Best Practices for Forensic Video Analysis Version NOTE: Examiners should be aware that audio may be present within video recordings. In order to ensure the best possible playback and viewing conditions of tape based evidence as it passes through the video processing chain, each piece of equipment and connections between equipment should be optimized. This will allow for the best evidence to be preserved, examined and further analyzed. Key components of the video chain may be assessed using test patterns. For example, test patterns assist in the detection of noise and allow for adjustments to be made. A regular maintenance and cleaning schedule will assist in equipment reliability. For tape based media Prior to inserting videotape evidence into a playback device, ensure the equipment is functioning properly by inserting a non-evidentiary test tape of known signal and image quality. When playback of the evidentiary tape is less than optimal or signal dropouts occur, and the analyst suspects player idiosyncrasies as a potential factor, multiple players and/or recorders should be utilized to preview the tape. In some cases, this may necessitate retrieving the original recorder and/or camcorder unit. For example, head misalignment on the original recorder may produce a tape in which video playback is degraded or not viewable when played back on any unit other than the original recording device. Tracking adjustment may be necessary to optimize playback of the original video. Analog based media usually requires visual examination of the individual recorded fields. NTSC, PAL, and SECAM standards require appropriate equipment for viewing, conversion, and playback purposes to accommodate varying frame rates, aspect ratios and lines per frame. Care should be taken to avoid extended playing or pausing of tape based media to prevent damage or degradation of the original video. For file based digital video recordings The minimum specifications provided by the relevant manufacturers to ensure proper playback, display resolution, and overall quality should be utilized when playing back file based digital video recordings. This applies to the particular video workstation hardware (e.g. processor, hard drive, memory, graphics card) and software (e.g. operating system, proprietary video player). Digital video files and software that are recorded on removable media (e.g. CD-R, flash memory card) should be copied to the video workstation for playback, if possible. For Digital CCTV (DCCTV), if possible obtain the pertinent video information in the native file format with the appropriate player. The analyst should be aware that different methods of playback and extraction (including universal players) may yield different results. When reviewing digital video using the proprietary software, the player or on-screen display (OSD) may affect the representation of the video. An incorrect display aspect ratio will not accurately depict the dimensions of the

8 actual recorded video. For example, objects that should have been recorded as circles may be depicted as ovals instead. In some instances the original recording hardware, or equipment of the same make and model, may be necessary for playback. In order to maintain image quality, the highest available signal path should be chosen for the devices in the FVA chain (e.g. s-video over composite). Cable optimization can minimize electromagnetic interference, which can produce static or noise. Cable lengths should be as short as possible. Arrange any excess cable in an "S" or figure eight shape, avoiding loops and coils. Kinks or cables bent at sharp angles can damage cable connectors or the terminals of equipment. Keep power cords away from audio and video cables if possible. Even shielded cables can be affected by power cords, which can cause electromagnetic interference and signal degradation. If cables must cross over power cords, these should cross at right angles. Generation Determination If during playback optimization there are indications that the submitted media is a copy, contact the submitter to obtain the original if it exists. Indications of an analog copy may include multiple head switching points viewed on an underscan monitor or an analog recording of a digital CCTV source. For digital media, a file playable in a universal player may be an indication that transcoding of the native file format has occurred. Media Review The submitted media for analysis should be reviewed. Information regarding recording method, time/date of incident, and problems in playback or viewing of the recording should be verified. Any observed discrepancies with the information documented in the submitted request should be noted. A preliminary determination should be made with respect to the feasibility of the requested task (e.g. enhancement, comparison, duplication). If the analyst determines any additional tasks are necessary, these should be noted. When identifying the area of interest for analysis, the following should be considered: There may be relevant information outside the area of interest requested by the submitter Details about the incident not directly related to the subject may be present. These include; Images which could verify the time and/or place of the incident such as; clocks, signs, scoreboards Potential witnesses or bystanders SWGIT Guidelines for the Forensic Imaging Practitioner 7

9 8 Best Practices for Forensic Video Analysis Version Creation of a Work Copy and Verification A working copy of the pertinent area of the recording should be created. This copy should be made to ensure the preservation of video data in the event of accidental corruption, erasure, or other unexpected damage or degradation to the original recording media. Examples of working copies are; copying of digital files from optical media to another medium (e.g. hard drive) and magnetic tape to digital files (uncompressed/lossless). The working copy should be digitally and/or visually verified as to content and quality. For duplication purposes, a master copy should be created and all subsequent copies be made from this master. Where analog is concerned, this copy should be of the highest quality possible (VHS to VHS copying should be avoided whenever possible due to loss of quality). Processing, Enhancement, and Examination Video that has been processed should be documented. This documentation should include the order in which the processes were applied to ensure the integrity and the reproducibility of the results. Specific information and additional SWGIT recommendations related to video/image related enhancements may be found in the SWGIT document Best Practices for Documenting Image Enhancement. The following alphabetical list provides a brief discussion of various processing, enhancement, and examination techniques utilized in FVA, and specific recommendations for their use. Many of these techniques can be applied over an entire image (globally) or over a specific area (locally). Brightness/Contrast The specific settings for brightness and contrast filters should be set so that the level of detail for the area of interest is not adversely affected. Steps should be taken to ensure that clipping does not occur in the area of interest within the image. In a global brightness adjustment, areas of the image that are not pertinent may in fact be made less visible in order to optimize the pertinent area. Color Correction A known standard, such as MacBeth or SMPTE standardized charts, should be used when the most precise color correction is necessary. The chart should be captured under the same conditions, position and location as the original video and color balanced to a neutral tone. This color balance can be based on a visual display on a calibrated color monitor or by using the values displayed for this neutral toned object in the info palette of an image processing program. Cropping/Resizing Cropping/Resizing must not result in a misleading and/or inaccurate representation. Deinterlacing CCTV recordings may require deinterlacing to achieve the best image possible. This should be performed before any other process. Deinterlacing may be necessary in circumstances where display of the original interlaced signal results in

10 obscured or degraded image detail. For example, a VHS CCTV recording may contain noise only in the odd field of the video signal, due to a damaged or dirty record head on the recording VCR. Another example is motion between individual fields, as shown in Figures 1 and 2. In these cases, normal playback of the interlaced video may obscure image details in the recording. Therefore, deinterlacing the video signal and creating a processed version from a single field may result in clearer video images. Figure 1. Interlaced Image Figure 2. Deinterlaced Image Demonstrative Comparison Demonstrative Comparison occurs when multiple images are placed side-by-side for the purpose of visual comparison. This consists solely of preparing the composite exhibit. If the analyst indicates points of similarity or dissimilarity this represents an opinion about the content of the images; subject matter expertise and the principles of Image Analysis thus apply. Ensure that all the displayed images have the correct aspect ratio and that significant features are approximately the same size. To the degree practical, displayed images should depict the same composition including such features as camera to subject geometry (perspective), lighting, color rendition, focus, etc. Analysis of the content of video images for the purpose of rendering a conclusion regarding the depicted subject(s) is beyond the scope of this document. This may include photogrammetric analysis or photographic comparison. For further information refer to SWGIT document Best Practices for Forensic Image Analysis. Demultiplexing Demultiplexing may be accomplished through hardware or software tools. Hardware based Hardware based demultiplexing may allow for the decoding of date, time, and other camera information. SWGIT Guidelines for the Forensic Imaging Practitioner 9

11 Hardware based demultiplexing can result in cropping and/or softening of the images. Also, the verification of dropped and/or incorrectly sorted frames may not be possible. If available, the same make and model of multiplexer/demultiplexer used in producing the original recording should also be used for hardware demultiplexing. Third party multi-format hardware demultiplexers may also be used; however, there may be a variation in the results. Optimal hardware configuration includes a monitor before the demultiplexing as well as a review monitor. This allows for simultaneous input and output monitoring. Playback speed should be adjusted to run at an appropriate time-lapse rate in order to minimize the potential of the multiplexer skipping or dropping frames. Figure 3. Figure 3 shows a three-camera multiplexed combined signal and Camera 1 demultiplexed. Software based Software based demultiplexing may allow the analyst to verify that frames were correctly sorted and none were dropped. This method typically uses image content to separate multiplexed cameras. Time and date information is often not displayed. Pay particular attention to Pan-Tilt-Zoom (PTZ) cameras, and cameras with drastic lighting and/or scene changes, as they may cause difficulty for software based demultiplexing programs. Noise Reduction The best method to reduce noise will depend on the type of noise present in a given image or video. Frame averaging and single frame noise reduction techniques may be effective for different types of image noise. 10 Best Practices for Forensic Video Analysis

12 Frame averaging is most often useful when there are multiple frames and no movement of the camera or the subject of interest. Any single frame noise reduction technique will always be a trade off between reducing the noise and blurring or eliminating detail. Sometimes no noise reduction is the best choice when enhancing an image in order to maintain fine details and textures. Sharpening/Deblurring Sharpening techniques can be useful to enhance edge detail. Since the fine detail of an image lies in the high frequencies, video analysts may want to boost the high frequencies of an image in an attempt to better visualize these details. Some noise also exists in high frequencies. Any attempt to boost the details contained in the high frequencies of an image will also boost the high frequency noise. This amplification of noise is the major limitation in any sharpening technique applied to images and video. Over sharpening an image, besides boosting the noise, may also result in an unnatural look to the enhanced image. Some sharpening processes may change the average brightness and/or contrast of an image. VCR circuitry can contain a sharpening element. Care should be taken that this effect is willfully activated or deactivated and the consequences of it are understood. Image restoration techniques, such as deblurring, can be used to reduce the motion, lens, and Gaussian blur. A deblurring technique is not the same as a sharpening technique. However, if no deblurring tool is available, a sharpening tool may be effective. Speed Adjustment Speed adjustment of forensic video is typically performed for the following reasons: To convert the playback speed of time lapsed video recordings to a real-time rate. To slow the playback speed of video to a less-than-real-time rate ( slow motion ). This is often done to facilitate the viewing of images and action details occurring in the original recording. Speed adjustments are made by varying the playback frame rate, and may be accomplished through hardware (e.g. time-lapse VCR) or video-processing software (e.g. motion effects). SWGIT Guidelines for the Forensic Imaging Practitioner 11

13 Timeline Sequencing Timeline sequencing can be an effective way to show subject movement through a scene or a series of events. Every pertinent image should be included in the timeline displayed or verified time/date information and/or frame numbers. Scene content may also be useful in verifying the proper sequence of recorded images. Examples of scene content may include movement of vehicles or people. Images used in timeline sequencing may come from multiple cameras at one location or multiple locations. Proper documentation when performing any of these methods is essential. Video Stabilization Video Stabilization is typically performed at the field level, and may be either an automatic or manual process. This is usually performed prior to attempting noise reduction using inter-frame adding or averaging operations. Figure 4. Area of Interest Figure 4 shows an original sequence of images captured with a handheld VHS-C camcorder. The vehicle is moving within the frames as the result of camera jitter and vehicle movement. To correct for this, an area of interest is defined within an image that subsequent video frames will be aligned with. Figure 5. Figure 5 shows the processed video sequence. The vehicle has been stabilized, by aligning the frames to the previously selected area of interest. Notice that the frames are being moved (horizontally and vertically) and rotated to align them. 12 Best Practices for Forensic Video Analysis

14 Output Results can be output to media, such as videotape, prints, write once optical media (e.g. DVD, CD), hard drive, etc., for return to the requestor. Media should be write protected, when possible. Rewritable optical media (e.g.dvd-rw, CD-RW) should not be used. Any notations added to the final image results, such as agency logos, text, case information, or examiner markings, should not obscure the pertinent area. The type of output images (video, stills, or a combination) is dependent upon what best illustrates the content, quality, and events to be depicted in the final product. When deciding what to output, consider the intended use and the quality of the images available as well as the needs of the requestor for playback and courtroom presentation. If adjustments for pixel aspect ratio are required for printing, in most cases, they should be done after all image processing and enhancement is performed. Prior to output, ensure the pixel aspect ratio is correct for the chosen media. If the aspect ratio is not correct, the output results may not be proportionate (width to height) and will not be an accurate representation of the original image. Durability, longevity and quality of prints produced should be considered. Whenever possible, the printer manufacturer s recommendation for ink, paper, storage, maintenance, and settings should be followed. The most important aspect of printing is that the printed still image files remain a true and accurate representation of the original event. When outputting to digital media, be aware that several factors can reduce output quality. These include: High compression rates Long record times Poor quality equipment and media Incorrect settings Verification Any output should be verified to check that all content was transferred successfully and that the quality of the output accurately reflects the results of the examination and/or analysis. The analyst should be aware that there may be compatibility issues between the output produced and the playback device. Ideally, output should be verified on multiple systems to ensure optimal playback compatibility. After verification, the original media and all processed output should be properly labeled, sealed and packaged according to your agency s SOPs. SWGIT Guidelines for the Forensic Imaging Practitioner 13

15 Appendix A Video Submission Form SUBMISSION OF VIDEO EVIDENCE Date Agency Case # Submitter Name Agency Offense Phone # Cell # VICTIM (or SUBJECT) RACE SEX DOB 1 2 SUSPECT RACE SEX DOB 1 2 Version Brief Details of Case (Attach Report if Necessary) Examinations Requested CCTV System Information Digital Video Recorder Make, Model, Serial Number PC Based Stand Alone Networked (Circle One) Playback software name and version Software provided with evidence YES or NO (Circle One) System and/or Software Password System Settings: Image Quality (i.e. high, medium, low) Frames per second (fps)/pictures per second(pps) Image/Frame recorded size (e.g. 320 x 240) Can it be determined if any cameras are alarm or motion triggered? Number of hard drives, storage capacity of each 14 Best Practices for Forensic Video Analysis

16 System firmware version Other available system settings (e.g. event log) Analog Video Recorder Make, Model, Serial Number VHS SVHS Other (Circle One) What record mode was the system? (Circle One) 2 hour, 6 hour, 12 hour, 24 hour, 48 hour 72 hour, Other Unknown Multiplexer YES or NO Make and Model Basic Information Does the recorded date/time accurately represent the time of day? (circle) YES or NO Date/Time displayed Actual date/time # of Camera/s Active # of cameras Camera make and model Are any cameras infrared-sensitive and if so identify Is audio being recorded? Is a copy of the most current maintenance/service log attached? (circle) YES or NO Other Information: Scene Contact Information Scene Address Hours of operation Scene point of contact CCTV system point of contact Telephone: Telephone: Please provide a sketch of the scene indicating camera position and placement. Submitted By Signature Print Name SWGIT Guidelines for the Forensic Imaging Practitioner 15